01 / The operating case
What changes in a real workflow?
An incident commander cancels a remediation task while a child agent is queued to isolate a server.
- 01Origin grant
- 02Parent agent
- 03Narrow child grant
- 04Action boundary
02 / Decision contract
What the executor must check
Track ancestor references, broadcast revocation, invalidate cached decisions and recheck the chain when the child resumes.
Architecture review / negative test
Make the boundary testable.
Descendant invalidation follows grant ancestry, not a list of currently running processes. A paused child and a remote child may have valid credentials long after the parent task ends. Define whether revocation is synchronous at the executor or eventually propagated, and make the residual window visible to operators.
03 / Failure and evidence
What goes wrong, and what can be proven?
A child carries an unexpired credential and executes after the parent is cancelled.
Measure propagation lag and record denial or any in-flight effect that could not be stopped.
04 / Canonical scope
Why this reference stands alone
Authority revocation covers the general lifecycle; this page owns descendant traversal and resumed-task behavior.
Primary references